> ## Documentation Index
> Fetch the complete documentation index at: https://docs.soverage.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> High-level architecture, DLT layer, and open standards

Soverage Gateway is built on open standards and a privacy-first design. This page provides a high-level overview of the technical architecture.

## Overview

```mermaid theme={null}
graph TB
    subgraph USER["User Device"]
        direction LR
        W["Wallet"]
        DID["DID + Keys"]
        CRED["Credentials"]
    end

    subgraph GW["Soverage Gateway"]
        direction LR
        AI["Document Analysis"]
        OID["OID4VCI / OID4VP"]
    end

    subgraph CHAIN["DLT Layer"]
        direction LR
        DIDCHAIN["DID Documents"]
        COMMIT["Attestation Commitments"]
        PT["Personhood Tokens"]
    end

    VERIFY["Third-Party Verifier"]

    USER <--> GW
    USER --> CHAIN
    GW --> CHAIN
    USER --> VERIFY
    VERIFY -.-> CHAIN
```

## Components

### User device (privacy boundary)

DID keys, credentials, and attestation data are stored locally on the user's device. The wallet is used for signing operations only. No funds are transferred. Personal data never leaves the device.

### Gateway (stateless)

The Soverage Gateway handles document verification and credential management (issuance, presentation). It is the coordination layer between the user and the DLT. The gateway is **stateless with respect to personal data**: document images are analyzed in memory and immediately discarded. No PII is retained after verification completes.

### DLT layer (public, immutable)

Soverage is **multi-chain by design**. The DLT layer stores only cryptographic artifacts, never personal data:

* **DID documents**: public keys and service endpoints, resolvable by anyone
* **Attestation commitments**: SHA-256 hashes that prove verification happened without revealing what was verified
* **Personhood Tokens**: non-transferable tokens representing verified personhood

The architecture abstracts these services so that the same identity primitives (DIDs, VCs, Personhood Tokens) work across different networks. Currently live on [Hedera](https://hedera.com/), with support for additional chains planned.

### Third-party verification

Verifiers can check credentials **without contacting Soverage**. They resolve the user's DID directly on-chain, verify the VC signature, or check token ownership, all independently and trustlessly.

## Verification pipeline

The verification pipeline combines multiple independent signals to build a user's identity profile. Document analysis is one component. Additional attestations (email, phone, device, social account) provide independent verification signals. Each step produces a cryptographic commitment, not stored data.

For details on what the pipeline outputs and how to verify it, see [How It Works](/how-it-works). For more on the privacy guarantees, see [Privacy & Security](/privacy-and-security).

## Standards

| Standard                                            | Reference                                                                                                                             |
| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| W3C Verifiable Credentials                          | [w3.org/TR/vc-data-model](https://www.w3.org/TR/vc-data-model/)                                                                       |
| W3C Decentralized Identifiers                       | [w3.org/TR/did-core](https://www.w3.org/TR/did-core/)                                                                                 |
| OpenID for Verifiable Credential Issuance (OID4VCI) | [openid.net/specs/openid-4-verifiable-credential-issuance](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html) |
| OpenID for Verifiable Presentations (OID4VP)        | [openid.net/specs/openid-4-verifiable-presentations](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html)             |
| Ed25519 signatures                                  | [RFC 8032](https://datatracker.ietf.org/doc/html/rfc8032)                                                                             |
| WebAuthn                                            | [w3.org/TR/webauthn](https://www.w3.org/TR/webauthn-2/)                                                                               |

## Current network

Currently running on [Hedera Testnet](https://hashscan.io/testnet), using the [Hedera Consensus Service](https://docs.hedera.com/hedera/sdks-and-apis/sdks/consensus-service) for DIDs and attestations, and the [Hedera Token Service](https://docs.hedera.com/hedera/sdks-and-apis/sdks/token-service) for Personhood Tokens. Additional networks are planned.